CWE-457 Use of Uninitialized Variable
variantThe code uses a variable that has not been initialized, leading to unpredictable or unintended results.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (439)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2009-0901US | high9.3 | — | ||
The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP… | ||||
| CVE-2025-54874US | critical9.8 | Exploit | ||
OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG from 2.5.1 through 2.5.3, a call to opj_jp2_read_header may lead to OOB heap memory write when the data stream p_stream is t… | ||||
| CVE-2007-0214US | high9.3 | — | ||
The HTML Help ActiveX control (Hhctrl.ocx) in Microsoft Windows 2000 SP3, XP SP2 and Professional, 2003 SP1 allows remote attackers to execute arbitrary code via unspecified functi… | ||||
| CVE-2021-40418US | critical9.8 | — | ||
When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assignment of a property containing an object referring to a UUID… | ||||
| CVE-2014-4489US | high10.0 | — | ||
IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly initialize event queues, which allows attackers to execute arbitrary c… | ||||
| CVE-2018-25014US | critical9.8 | — | ||
A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol(). | ||||
| CVE-2010-3555US | high9.3 | — | ||
Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availabi… | ||||
| CVE-2025-53644US | critical9.8 | — | ||
OpenCV is an Open Source Computer Vision Library. Versions 4.10.0 and 4.11.0 have an uninitialized pointer variable on stack that may lead to arbitrary heap buffer write when readi… | ||||
| CVE-2024-47540US | critical9.8 | — | ||
GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst_matroska_demux_add_wvpk_he… | ||||
| CVE-2022-40510US | critical9.8 | — | ||
Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder. | ||||
| CVE-2022-21217US | critical9.8 | — | ||
An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted network request can lead to an out-of… | ||||
| CVE-2012-1014US | high9.0 | — | ||
The process_as_req function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.10.x before 1.10.3 does not initialize a certain structure member, which allows remo… | ||||
| CVE-2007-5894US | high9.3 | — | ||
The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and re… | ||||
| CVE-2026-2806US | critical9.1 | — | ||
Uninitialized memory in the Graphics: Text component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. | ||||
| CVE-2025-5749US | high8.8 | — | ||
WOLFBOX Level 2 EV Charger BLE Encryption Keys Uninitialized Variable Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentica… | ||||
| CVE-2024-6990US | high8.8 | — | ||
Uninitialized Use in Dawn in Google Chrome on Android prior to 127.0.6533.88 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (… | ||||
| CVE-2023-6324US | high8.8 | — | ||
ThroughTek Kalay SDK uses a predictable PSK value in the DTLS session when encountering an unexpected PSK identity | ||||
| CVE-2023-32213US | high8.8 | — | ||
When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. | ||||
| CVE-2022-31741US | high8.8 | — | ||
A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption. This vulnerability affects Thunderbird <… | ||||
| CVE-2026-34608US | high8.2 | — | ||
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.10, in NanoMQ's webhook_inproc.c, the hook_work_cb() function processes nng messages by… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan